News release

Employment terminated for individuals involved in data breach; notifying the appropriate federal officials for further investigation and potential criminal review

OLYMPIA – The Washington State Health Care Authority (HCA) discovered that the personal identification information and private health information of more than 91,000 Apple Health (Medicaid) clients was handled improperly by an individual HCA employee. HCA today is sending a notification letter to clients affected by the breach.

"Our first and foremost priority is protecting our clients’ personal information," said HCA Risk Manager Steve Dotson. "We have taken swift action to address this issue and help prevent future incidents. I know this is stressful and concerning for those impacted, and we are doing everything possible to support them."

Two state employees in two state agencies exchanged Apple Health client files in violation of requirements under the federal Health Insurance Portability and Accountability Act (HIPAA). Both employees assert that the exchange of information occurred because the HCA employee needed technical assistance with spreadsheets that contained the data and that the information was not used for any additional unauthorized purposes or forwarded to any other unauthorized recipients. The breach was discovered in the course of a whistleblower investigation into misuse of state resources.

"While we have no indication that the client files went beyond the two individuals involved, Important privacy laws were violated and we are exercising caution and due diligence given the nature of the information," Dotson said.

Because the investigation could not confirm that the data stayed within the state’s systems, it was determined there was a breach of protected data, requiring client notification.

Both individuals’ employment has been terminated.

Upon discovering the breach, HCA:

Conducted an internal investigation that included securing and searching the employee’s computer to understand what information was exchanged.

Partnered with the state agency whose employee was the recipient of the information to further understand what information was exchanged and to ensure HCA information was secure.

Media contact

About the Health Care Authority

HCA is the state’s top health care purchaser, covering more than 2 million Washington residents through Apple Health (Medicaid) and the Public Employees Benefits Board (PEBB) Program. We work with partners to help ensure Washingtonians have access to better health and better care at a lower cost.